Download to read offline
More Related Content
Similar to Comp8 unit6a lecture_slides
Comp8 unit6a lecture_slides
- 1. Installation and Maintenanceof Health IT Systems System Security Procedures and Standards Lecture a This material (Comp 8 Unit 6) was developed by Duke University, funded by the Department of Health and Human Services, Office of the National Coordinator for Health Information Technology under Award Number IU24OC000024. This material was updated in 2016 by The University of Texas Health Science Center at Houston under Award Number 90WT0006. This work is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-sa/4.0/.
- 2. System Security Proceduresand Standards Learning Objectives 1. Identify regulatory requirements for EHRs (lecture a) 2. Provide training for system users regarding the methods and importance of security compliance (lecture a) 3. Identify administrative, physical, and technical safeguards for system security and regulatory compliance (lectures a and b) 4. Identify best practices for system security (lecture b) 5. Identify best practices for risk / contingency management (lecture b) 2
- 3. Security and Privacy •Federal, state, and local laws govern access to and control of health record information, particularly: – Who can have access – What should be done to protect the data – How long the records should be kept – Whom to notify and what to do if a breach is discovered 3
- 4. Security and Privacy:HIPAA • HIPAA = Health Insurance Portability and Accountability Act of 1996 – Protected Health Information (PHI) includes any health information that: • Explicitly identifies an individual • Could reasonably be expected to allow individual identification. – Excludes PHI in education records covered by Family Educational Rights and Privacy Act (FERPA), employment records. 4
- 5. Security and Privacy:HIPAA (cont’d) 18 identifiers recognized as providing identifiable links to individuals. – Name, address, ZIP code – Dates (birth dates, discharge dates, etc.) – Contact info, including email, web URLs – Social Security Number or record numbers – Account numbers of any sort – License number, license plates, ID numbers – Device identifiers, IP addresses – Full face photos, finger prints, recognizable markings (Summary of the HIPAA Privacy Rule, n.d.) 5
- 6. Security and Privacy(cont’d) • State and local laws vary. • Federal law tends to supersede state and local laws. Where overlap occurs, always choose the most protective policy. • Information available in state or local area Health department – see Minnesota example • Requirements are followed regardless of ease of finding information – Ignorance is no excuse! • This lecture will focus on federal regulatory obligations. (Minnesota Health Information Clearinghouse, n.d.) 6
- 7. What is HIPAAPrivacy? • Federal law governing privacy of patients' medical records and other health information maintained by covered entities including: – Health plans, including Veterans Health Administration, Medicare, and Medicaid – Most doctors & hospitals – Healthcare clearinghouses • Gives patients access to records and significant control over use and disclosure. • Compliance required since April 2003. (Summary of the HIPAA Privacy Rule, n.d.) 7
- 8. HIPAA Privacy Rule •Privacy and security complaints – All investigated by Office of Civil Rights (OCR) of Dept. of Health and Human Services (HHS), as of 2016. – 102,292 complaints received (as of December 2014), of which 23,214 required corrective actions. – 7,883 technical assistance cases in 2013-3014. – Steep fines for validated complaints. – Entities needing the most corrective actions: • Private health care practices • General hospitals • Pharmacies • Outpatient facilities • Group health plans (HIPAA Enforcement Highlights, 2016; Numbers at a Glance, n.d.; Poremba, 2008; Hamilton, 2009) 8
- 9. HIPAA Privacy Rule(cont’d) Violations investigated most often: 1. Impermissible uses and disclosures of protected health information (PHI) 2. Lack of safeguards of PHI 3. Lack of administrative safeguards 4. Lack of patient access to their PHI 5. Lack of technical safeguards (HIPAA Enforcement Highlights, 2016; Numbers at a Glance, n.d.; Poremba, 2008; Hamilton, 2009) 9
- 10. HIPAA Security Rule •Established standards for securing electronic protected health information (ePHI) created, received, maintained, or transmitted. – Delineated as “required” or “addressable”. – Designed to be flexible, scalable. • Entities required to: – Ensure confidentiality, integrity, availability of all ePHI – Identify and protect against reasonably anticipated threats to the security or integrity of the information. – Protect against reasonably anticipated, impermissible uses or disclosures. – Ensure compliance by workforce. • Works in tandem with Privacy Rule. (Summary of the HIPAA Security Rule, n.d.) 10
- 11. What is Requiredby HIPAA Security Rule? Categories: 1. Administrative safeguards 2. Physical safeguards 3. Technical safeguards (Summary of the HIPAA Security Rule, n.d.) 11
- 12. Administrative Safeguards • Addressprocess of security management in your organization. • Risk analysis – Evaluating likelihood and impact of potential risks to ePHI – Implementing appropriate security measures to address identified risks – Documenting security measures chosen, with rationale – Maintaining continuous, reasonable, appropriate protections • Ongoing process, with regular reviews. (Summary of the HIPAA Security Rule, n.d.) 12
- 13. Administrative Safeguards (cont’d): Securitypersonnel • Designated security official – Responsible for developing and implementing security policies and procedures. – Knowledge of good HIPAA practices – Familiarity with established IT security standards – Ability to interface well with all levels of management and staff. (Summary of the HIPAA Security Rule, n.d.) 13
- 14. Administrative Safeguards (cont’d): Accesspolicy – Policies & procedures for authorizing access to ePHI only when appropriate for one’s role (role-based access). • Who gets access to ePHI data? • What level of access is needed? • Who is the agent authorizing the access? • Is this authorization adequately documented? • Is the access periodically reviewed? • Is there a process for rescinding access when no longer needed? (Summary of the HIPAA Security Rule, n.d.) 14
- 15. Administrative Safeguards (cont’d): Training& Evaluation • Processes for appropriate authorization and supervision of workforce members who work with ePHI. • Well-documented training of all workforce members in security policies and procedures – Appropriate sanctions against violators. • Periodic assessment of procedures and policies – Are they still appropriate? – Are they being followed? (Summary of the HIPAA Security Rule, n.d.) 15
- 16. Physical Safeguards: Access •Limit physical access to facilities, while ensuring that authorized access is allowed. – Server rooms where ePHI is stored – Work areas where ePHI is accessed – Back-up media storage potentially containing ePHI • Inventory hardware and software. – Know where inventory is kept. – Know value of hardware, software, equipment. (Summary of the HIPAA Security Rule, n.d.) 16
- 17. Physical Safeguards (cont’d): DeviceSecurity • Policies and procedures for proper use of & access to workstations & electronic media, including transfer, removal, disposal, re-use. – Lock down publicly-accessible systems potentially containing ePHI. – Strong passwords – At least 256-bit encryption, especially for wireless, backups, & offsite data – Media thoroughly wiped and rendered inaccessible (Summary of the HIPAA Security Rule, n.d.) 17
- 18. System Security Procedures andStandards Summary – Lecture a • Protected health information (ePHI) – Strictly regulated by HIPAA and other government guidelines prohibiting unwanted, unauthorized access. – Should be protected using layered approach, including numerous, administrative, physical, and technical safeguards. • User training – Ensure awareness – Document and Review effectiveness 18
- 19. System Security Procedures andStandards References – Lecture a References: Summary of the HIPAA Privacy Rule. (n.d.). Retrieved from U.S. Department of Health & Human Services website: http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html Summary of the HIPAA Security Rule. (n.d.). Retrieved from U.S. Department of Health & Human Services website: http://www.hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html Enforcement Highlights. (2012, January 12) Retrieved from U.S. Department of Health & Human Services website: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/highlights/index.html Numbers at a Glance. (n.d.) Retrieved January 12, 2012, from U.S. Department of Health & Human Services website: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/highlights/indexnumbers.html Poremba, S. M. (2008, May 23). Proliferating Hipaa Complaints and Medical Record Breaches. Retrieved from SC Magazine website: http://www.scmagazine.com/proliferating-hipaa-complaints- and-medical-record-breaches/article/110555/ Hamilton, K. (2009, January 15). EHR Security and Privacy. Retrieved from SC Magazine website: http://www.scmagazine.com/ehr-security-and-privacy/article/125983/ Minnesota Health Information Clearinghouse, Medical Records Information. (n.d.) Retrieved January 12, 2012 from Minnesota Department of Health: http://www.health.state.mn.us/clearinghouse/medrecords.html Department of Health and Human Services (HHS), Office of Civil Rights (OCR), HIPAA Privacy Rule. 45 CFR Subtitle A (10-1-11 Edition) Part 154.514 Retrieved January 20, 2012 from GPO: http://www.gpo.gov/fdsys/pkg/CFR-2011-title45-vol1/pdf/CFR-2011-title45-vol1-sec164-514.pdf 19
- 20. Installation and Maintenanceof Health IT Systems System Security Procedures and Standards Lecture a This material was developed by Duke University, funded by the Department of Health and Human Services, Office of the National Coordinator for Health Information Technology under Award Number IU24OC000024. This material was updated in 2016 by The University of Texas Health Science Center at Houston under Award Number 90WT0006. 20
Editor's Notes
- #2 Welcome to Installation and Maintenance of Health IT Systems, System Security Procedures and Standards. This is Lecture a. This component covers fundamentals of selection, installation, and maintenance of typical Electronic Health Records (EHR) systems. This unit, System Security Procedures and Standards, will discuss the security rules required by regulation and best practices for implementation and monitoring of security in EHR systems.
- #3 The objectives for this unit System Security Procedures and Standards are to: Identify regulatory requirements for EHRs Provide training for system users regarding the methods and importance of security compliance Identify administrative, physical, and technical safeguards for system security and regulatory compliance Identify best practices for system security Identify best practices for risk / contingency management In any software system, security should be the number one priority of administrators and developers. Enacting good security measures – in other words, handling information well and protecting it from attack – not only safeguards the business from financial and legal liability, but also is a measure of professionalism. Before implementing new EHR software, whether a commercial off-the-shelf, or COTS, product or one you’ve developed in-house, it’s important both to look for software defects that may compromise security and to establish reasonable safeguards and policies to prevent abuse and security breaches. In today’s lecture we will cover what is security and privacy of health information and some ways it can be compromised. Next we will discuss the agencies responsible for regulating the protection of data and what your requirements are, along with some baseline practices you can use to protect your infrastructure. Finally, we’ll address the largest security threat of all (users) and ways to mitigate issues with training and compliance.
- #4 Security and privacy with regards to health records are tightly governed by federal, state, and local laws. These laws govern: Who can legally have access to any type of health information; What measures must be taken to protect those records; How long those records must be stored; And whom to notify and what you need to do if records have been compromised.
- #5 HIPAA, or the Health Insurance Portability and Accountability Act of 1996, is primarily responsible for governing the protection of individual health data. Many states have also passed legislation to further enhance these federal guidelines. Protected health information (PHI) under HIPAA includes any individually identifiable health information. Identifiable refers not only to data that is explicitly linked to a particular individual, it also includes health information with data items which reasonably could be expected to allow individual identification. Note that the definition of PHI excludes individually identifiable health information in education records covered by the Family Educational Rights and Privacy Act (FERPA). Employment records held by a covered entity are also exempt from this federal regulation.
- #6 Under HIPAA, 18 different identifiers are recognized as providing identifiable links to individuals: Names All geographical subdivisions smaller than a state, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code, if according to the current publicly available data from the Bureau of the Census: (1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) The initial three digits of a zip code for all geographic units containing 20,000 or fewer people is changed to 000. 3. All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older 4. Phone numbers 5. Fax numbers 6. Electronic mail addresses 7. Social Security numbers 8. Medical record numbers 9. Health plan beneficiary numbers 10. Account numbers 11. Certificate/license numbers 12. Vehicle identifiers and serial numbers, including license plate numbers 13. Device identifiers and serial numbers 14. Web Universal Resource Locators (URLs) 15. Internet Protocol (IP) address numbers 16. Biometric identifiers, including fingerprints and voice prints 17. Full face photographic images and any comparable images 18. Any other unique identifying number, characteristic, or code (note this does not mean the unique code assigned by an investigator to the code data)
- #7 Federal law tends to supersede state and local law. When in doubt or where overlap occurs, always plan on implementing the tightest control policy. It is important to familiarize yourself with all of these regulations, and the state and local health departments can be excellent resources. Remember that the requirements will come from the legislative body with jurisdiction over your practice area, so legal counsel should be consulted to identify applicable requirements and resolve conflicts. Since local and state laws vary from state to state, we will focus today on the federally mandated rules governing health data and storage.
- #8 As we alluded to earlier, the HIPAA Privacy Rule is a set of federal standards written to protect the privacy of patients' medical records and other health information maintained by covered entities. These entities consist of health plans, which include many governmental health programs such as the Veterans Health Administration, Medicare, and Medicaid; most doctors, hospitals and many other health care providers; and healthcare clearinghouses. These standards provide patients with access to their medical records and with significant control over how their personal health information is used and disclosed. Compliance with the standards was required beginning in 2003 for most entities covered by HIPAA.
- #9 The Office for Civil Rights is responsible for investigating all complaints associated with HIPAA security and privacy; however, only in 2009 did OCR assume responsibility for administering and responding to HIPAA security complaints. Since 2003, HHS (Health and Human Services) has received over 66,000 HIPAA Privacy complaints, of which over 15,000, after investigation, required changes in privacy practices and other corrective actions by the covered entities. At roughly $10,000 in fines per validated complaint, there’s no doubt that failure to ensure adequate safeguards can be costly to an organization. However, in the end, these losses pale in comparison when considering the organization’s potential loss of reputation and patient confidence, which can take years to rebuild. The most common types of covered entities that have been required to take corrective action to achieve voluntary compliance are, in order of frequency: Private practices; General hospitals; Outpatient facilities; Health plans (group health plans and health insurance providers); and Pharmacies.
- #10 From the compliance date to the present, the compliance issues investigated most are, compiled cumulatively, in order of frequency: Impermissible uses and disclosures of protected health information; Lack of safeguards of protected health information; Lack of patient access to their protected health information; Uses or disclosures of more than the minimum necessary protected health information; and Complaints to the covered entity.
- #11 The HIPAA Security Rule establishes national standards for the security of electronic protected health information (ePHI). The final rule adopting HIPAA standards for security was published in the Federal Register on February 20, 2003, and specifies a series of administrative, technical, and physical security procedures that covered entities must use to assure the confidentiality of electronic protected health information. The standards are delineated into either required or addressable implementation specifications. Compliance with the standards was required as of 2005, for most entities covered by HIPAA. The Security Rule requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting ePHI. Specifically, covered entities must: Ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain or transmit; Identify and protect against reasonably anticipated threats to the security or integrity of the information; Protect against reasonably anticipated, impermissible uses or disclosures; and Ensure compliance by their workforce. The Security Rule defines “confidentiality” to mean that ePHI is not available or disclosed to unauthorized persons. The Security Rule's confidentiality requirements support the Privacy Rule's prohibitions against improper uses and disclosures of ePHI. The Security rule also promotes the two additional goals of maintaining the integrity and availability of ePHI. Under the Security Rule, “integrity” means that ePHI is not altered or destroyed in an unauthorized manner. “Availability” means that ePHI is accessible and usable on demand by an authorized person. It’s important to note that the Security Rule was designed to offer flexible and scalable options to allow covered entities to analyze their own needs and implement solutions appropriate for their specific environments. What is appropriate for a particular covered entity will depend on the nature of the covered entity’s business, as well as the covered entity’s size and resources. Both the Privacy Rule and the Security Rule work in tandem to help ensure that healthcare data is properly protected.
- #12 The HIPAA Security rule requires covered entities to guarantee certain safeguards to protect ePHI data. These safeguards can be broken down into categories: Administrative Safeguards Physical Safeguards and Technical Safeguards Let’s take a closer look at each of these categories, their requirements, and some specific options available so you can adequately address them.
- #13 Administrative safeguards address the process you have put into place in your organization to administer security of the ePHI system. Each organization is required to identify and analyze potential risks to its ePHI, and it must implement security measures that reduce those risks and vulnerabilities to a reasonable and appropriate level. This is done using a risk analysis. A risk analysis process includes, but is not limited to, the following activities: Evaluate the likelihood and impact of potential risks to ePHI; Implement appropriate security measures to address the risks identified in the risk analysis; Document the chosen security measures and, where required, the rationale for adopting those measures; and Maintain continuous, reasonable, and appropriate security protections. This should be an ongoing process. Regular reviews should be performed to evaluate the effectiveness of the security measures put in place, and newly identified potential risks to ePHI should be addressed in an ongoing fashion.
- #14 A covered entity must also designate a security official who is responsible for developing and implementing its security policies and procedures. Your network security officer or person handling network security should have knowledge of both HIPAA guidelines and IT security standards. He or she should be willing to take proactive measures to ensure the safety of the ePHI system and be able to communicate effectively with and solicit support from upper management as well as with staff at all levels of the organization.
- #15 The Security Rule requires a covered entity to implement policies and procedures for authorizing access to ePHI only when such access is appropriate based on the user’s or recipient's role within the organization. Written policies should be created, then endorsed by management, to explain the process for granting access to ePHI. This includes establishing, documenting, reviewing, and modifying a user's right of access, including termination of said access. This policy or group of policies should adequately address these questions: Who gets access to ePHI data? What level of access is needed? Who is the agent authorizing the access? Is this authorization adequately documented? Is the access periodically reviewed? Is there a process for rescinding access once it’s no longer needed?
- #16 The administrative safeguards also provide for appropriate authorization and supervision of workforce members who work with ePHI. A covered entity must routinely train all workforce members regarding its security policies and procedures, and it must have and apply appropriate sanctions against workforce members who violate its policies and procedures. Training can include newsletters, one-on-one consultation, media presentations, staff meetings, and the like. This training should be adequately documented for auditing purposes, including the time and date of the training, topics covered, and who attended. Training should encompass all users who may interface with ePHI in some manner, including upper management. Note that although HHS-collected information about breaches does not include those caused directly by personnel (through social engineering or exploitation of poor security practice or simple error), people remain the largest security risk. Training is an important additional safeguard to ensure good security practices. Any policies and procedures that are developed must also undergo a periodic review and evaluation process. Since the regulatory environment may change with new legislation or newly identified best practices, older policies may be out-of-date or no longer appropriate. Additionally, onerous or poorly-implemented policies may cause development of security bypassing “workarounds” from personnel that bypass critical security features. If these bypasses are used to “get the job done” then the procedures bypassed need to be restructured so that the requirements of the Security Rule remain fulfilled.
- #17 Physical safeguards are written to address issues regarding facility access control, workstation use, workstation security, and device and media controls. This includes limiting physical access to work facilities without impeding access to those requiring access. This is particularly true in areas where ePHI may be present including work areas, server rooms, back-up media storage units, and the like. These areas require an extra level of protection to limit access to authorized users only and, whenever possible, create a structure for logging access, particularly any irregularities such as for maintenance staff, etc, who may require entry into these locations but are not considered routine in nature. Additionally, keeping a reliable hardware inventory – along with its value and locations – is also an important safeguard to preventing theft of a system which may inadvertently contain ePHI data.
- #18 Policies should also exist surrounding the acceptable use of any workstation or device or media with the potential of collecting or storing ePHI. This includes: Physically locking any workstations which are in public areas which may store ePHI Requiring the devices and EHR software to use strong passwords. A strong password has the core aspect of being difficult to guess. For this reason, there are many recommendations to increase password strength. The most important aspect of a strong password is length. Though counterintuitive, a password of “A%2j6A” is _much_ easier to break than “kitty1231231234”. Other restrictions to increase password strength include: NOT re-using passwords from a previous login or system, using numbers, punctuation, symbols, and upper and lowercase letters, and NOT using common dictionary words or parts of a login. Encrypting all storage media containing ePHI – The use of password protection instead of encryption is not an acceptable alternative to protecting ePHI. This is particularly true regarding wireless access of ePHI, say from laptops or PDAs; offsite access of any sort, or backup media, particularly media being transported off-site, whether physically or digitally through the network. Whenever possible, the strongest methods for encryption should be utilized, preferably with 256-bit or higher encryption. Backup media should be kept locked away in a secured environment with tight access controls. Additionally, policies should be implemented prohibiting the storage of ePHI on workstations, laptops, or any other unapproved device. Measures should be taken to routinely examine these devices for compliance. Likewise, when disposing hard drives or other connected media from these devices, they should be rendered completely useless after being thoroughly wiped a minimum of 7 times in a manner consistent with DOD specifications. There are plenty of free tools available for this purpose – DBAN (Derik’s Boot and Nuke) is popular.
- #19 This concludes lecture a of System Security Procedures and Standards. So, let’s take a moment to recap what we have covered so far: We’ve talked about the many facets of ePHI regulation, along with various administrative, physical, and technical safeguards available to assist you in protecting your infrastructure. We have discussed that HIPAA, along with additional state and local guidelines, requires healthcare data to be protected from unwanted and unauthorized disclosure. We have identified at least 18 different types of data in health records that are considered identifiable with regard to the federal guidelines. Healthcare data should be protected using a layered approach including enacting numerous administrative, physical, and technical safeguards. User training for personnel working with ePHI is critically important because they are the greatest threat to data security. Make sure personnel are aware of policies and procedures, document any training, and review the effectiveness of that training with periodic evaluation. Much of what you will do will hinge on the type, topology, and operating systems utilized in your infrastructure. In the next part of our lecture we will continue our discussion with technical safeguards often utilized in healthcare settings.
- #20 No audio.
- #21 No Audio.